diff --git a/calico-enterprise/observability/elastic/l7/datatypes.mdx b/calico-enterprise/observability/elastic/l7/datatypes.mdx
index 4fa836d850..8d35b7375f 100644
--- a/calico-enterprise/observability/elastic/l7/datatypes.mdx
+++ b/calico-enterprise/observability/elastic/l7/datatypes.mdx
@@ -8,38 +8,40 @@ $[prodname] supports multiple L7 collectors that write into the same Elasticsear
- **Envoy** — the legacy sidecar/proxy-based collector. See [Enable Envoy collector](configure.mdx).
- **eBPF** — kernel TCP-layer probes capturing HTTP request/response and TLS handshake metadata. See [Enable eBPF collector](enable-ebpf-collector.mdx).
-{/* TODO: re-add the Waypoint collector bullet when the Waypoint PR lands. */}
+- **Waypoint** — Istio Ambient Mode HTTP logging via the Waypoint Proxy. See [Enable Waypoint collector](enable-waypoint-collector.mdx).
+
+The Envoy and Waypoint collectors are both built on Envoy access logs, and the table below refers to them collectively as the _Envoy-based_ collectors. They share the same `collector_type` value (`envoy-access-log`) and are told apart by `collector_name`.
The table below details the key/value pairs in the JSON blob, including their [Elasticsearch datatype](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-types.html) and which collector(s) populate each field. "All" means every collector populates the field. Descriptions prefixed with _HTTP only_ or _TLS only_ mark fields that are populated for events of only that protocol family.
-| Name | Datatype | Populated by | Description |
-| ------------------------ | -------- | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `host` | keyword | All | Name of the node that collected the L7 log entry. |
-| `start_time` | date | All | Start time of log collection in Unix timestamp format. |
-| `end_time` | date | All | End time of log collection in Unix timestamp format. |
-| `bytes_in` | long | All | Number of incoming bytes since the last export. |
-| `bytes_out` | long | All | Number of outgoing bytes since the last export. |
-| `duration_mean` | long | All | Mean duration time of all the requests that match this combination of L7 data in nanoseconds. |
-| `duration_max` | long | All | Max duration time of all the requests that match this combination of L7 data in nanoseconds. |
-| `count` | long | All | Number of requests that match this combination of L7 data. |
-| `src_name_aggr` | keyword | All | Contains one of the following values:
- Aggregated name of the source pod.
- `pvt`: endpoint is not a pod. Its IP address belongs to a private subnet.
- `pub`: endpoint is not a pod. Its IP address does not belong to a private subnet. It is probably an endpoint on the public internet. |
-| `src_namespace` | keyword | All | Namespace of the source endpoint. |
-| `src_type` | keyword | All | Source endpoint type. Possible values:
- `wep`: A workload endpoint, a pod in Kubernetes.
- `ns`: A network set. If multiple match, priority is given to NetworkSets in the workload's own namespace, then to GlobalNetworkSets, and then to NetworkSets in other namespaces. For ties between matching network sets within each category, the one with the longest-prefix match is chosen. Remaining ties are resolved alphabetically by the NetworkSet's full identity (using namespace/name or just name).
- `net`: A Network. The IP address did not fall into a known endpoint type. |
-| `dest_name_aggr` | keyword | All | Contains one of the following values:
- Aggregated name of the destination pod.
- `pvt`: endpoint is not a pod. Its IP address belongs to a private subnet.
- `pub`: endpoint is not a pod. Its IP address does not belong to a private subnet. It is probably an endpoint on the public internet. |
-| `dest_namespace` | keyword | All | Namespace of the destination endpoint. |
-| `dest_type` | keyword | All | Destination endpoint type. Possible values:
- `wep`: A workload endpoint, a pod in Kubernetes.
- `ns`: A network set. If multiple match, priority is given to NetworkSets in the workload's own namespace, then to GlobalNetworkSets, and then to NetworkSets in other namespaces. For ties between matching network sets within each category, CIDR matches outrank domain matches and longest-prefix wins between competing CIDR matches. Remaining ties are resolved alphabetically by the NetworkSet's full identity (using namespace/name or just name).
- `net`: A Network. The IP address did not fall into a known endpoint type. |
-| `dest_service_name` | keyword | All | Name of the destination service. This may be empty if the request was not made against a service. |
-| `dest_service_namespace` | keyword | All | Namespace of the destination service. This may be empty if the request was not made against a service. |
-| `dest_service_port` | long | All | Destination service port. |
-| `url` | keyword | All | _HTTP only._ URL that the request was made against. |
-| `response_code` | keyword | All | _HTTP only._ Response code returned by the request. |
-| `method` | keyword | All | _HTTP only._ HTTP method for the request. |
-| `user_agent` | keyword | All | _HTTP only._ User agent of the request. |
-| `type` | keyword | All | Type of request made. Possible values include `tcp`, `tls`, and `html/`. |
-| `protocol` | keyword | eBPF | Wire-protocol family of the captured event. Possible values: `http`, `tls`. |
-| `protocol_version` | keyword | eBPF | Wire-protocol version. For HTTP events, possible values include `1.0` and `1.1`. |
-| `collector_type` | keyword | eBPF | Category of the collector that produced the event. For the kernel TCP-layer eBPF collector, the value is `ebpf`. |
-| `collector_name` | keyword | eBPF | Name of the specific collector that produced the event. For the kernel TCP-layer eBPF collector, the value is `ebpf-tcp`. |
-| `tls_sni` | keyword | eBPF | _TLS only._ TLS Server Name Indication sent by the client in the ClientHello. |
-| `tls_version` | keyword | eBPF | _TLS only._ Negotiated TLS protocol version (for example, `TLS 1.2`, `TLS 1.3`). |
-| `tls_cipher_suite` | keyword | eBPF | _TLS only._ Negotiated TLS cipher suite (for example, `TLS_AES_256_GCM_SHA384`). |
+| Name | Datatype | Populated by | Description |
+| ------------------------ | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `host` | keyword | All | Name of the node that collected the L7 log entry. |
+| `start_time` | date | All | Start time of log collection in Unix timestamp format. |
+| `end_time` | date | All | End time of log collection in Unix timestamp format. |
+| `bytes_in` | long | All | Number of incoming bytes since the last export. |
+| `bytes_out` | long | All | Number of outgoing bytes since the last export. |
+| `duration_mean` | long | All | Mean duration time of all the requests that match this combination of L7 data in nanoseconds. |
+| `duration_max` | long | All | Max duration time of all the requests that match this combination of L7 data in nanoseconds. |
+| `count` | long | All | Number of requests that match this combination of L7 data. |
+| `src_name_aggr` | keyword | All | Contains one of the following values:
- Aggregated name of the source pod.
- `pvt`: endpoint is not a pod. Its IP address belongs to a private subnet.
- `pub`: endpoint is not a pod. Its IP address does not belong to a private subnet. It is probably an endpoint on the public internet. |
+| `src_namespace` | keyword | All | Namespace of the source endpoint. |
+| `src_type` | keyword | All | Source endpoint type. Possible values:
- `wep`: A workload endpoint, a pod in Kubernetes.
- `ns`: A network set. If multiple match, priority is given to NetworkSets in the workload's own namespace, then to GlobalNetworkSets, and then to NetworkSets in other namespaces. For ties between matching network sets within each category, the one with the longest-prefix match is chosen. Remaining ties are resolved alphabetically by the NetworkSet's full identity (using namespace/name or just name).
- `net`: A Network. The IP address did not fall into a known endpoint type. |
+| `dest_name_aggr` | keyword | All | Contains one of the following values:
- Aggregated name of the destination pod.
- `pvt`: endpoint is not a pod. Its IP address belongs to a private subnet.
- `pub`: endpoint is not a pod. Its IP address does not belong to a private subnet. It is probably an endpoint on the public internet. |
+| `dest_namespace` | keyword | All | Namespace of the destination endpoint. |
+| `dest_type` | keyword | All | Destination endpoint type. Possible values:
- `wep`: A workload endpoint, a pod in Kubernetes.
- `ns`: A network set. If multiple match, priority is given to NetworkSets in the workload's own namespace, then to GlobalNetworkSets, and then to NetworkSets in other namespaces. For ties between matching network sets within each category, CIDR matches outrank domain matches and longest-prefix wins between competing CIDR matches. Remaining ties are resolved alphabetically by the NetworkSet's full identity (using namespace/name or just name).
- `net`: A Network. The IP address did not fall into a known endpoint type. |
+| `dest_service_name` | keyword | All | Name of the destination service. This may be empty if the request was not made against a service. |
+| `dest_service_namespace` | keyword | All | Namespace of the destination service. This may be empty if the request was not made against a service. |
+| `dest_service_port` | long | All | Destination service port. |
+| `url` | keyword | All | _HTTP only._ URL that the request was made against. |
+| `response_code` | keyword | All | _HTTP only._ Response code returned by the request. |
+| `method` | keyword | All | _HTTP only._ HTTP method for the request. |
+| `user_agent` | keyword | All | _HTTP only._ User agent of the request. |
+| `type` | keyword | All | Type of request made. Possible values include `tcp`, `tls`, and `html/`. |
+| `protocol` | keyword | All | Wire-protocol family of the captured event. Possible values: `http`, `tls`. |
+| `protocol_version` | keyword | All | Wire-protocol version. For HTTP events, possible values include `1.0` and `1.1`. |
+| `collector_type` | keyword | All | Technology family of the collector that produced the event. Possible values: `ebpf` for the eBPF collector, and `envoy-access-log` for the Envoy-based collectors (Envoy and Waypoint). |
+| `collector_name` | keyword | All | Specific collector that produced the event within the family. Possible values: `ebpf-tcp` (eBPF kernel TCP-layer collector), `daemonset` (Envoy collector), and `waypoint` (Waypoint collector). |
+| `tls_sni` | keyword | eBPF | _TLS only._ TLS Server Name Indication sent by the client in the ClientHello. |
+| `tls_version` | keyword | eBPF | _TLS only._ Negotiated TLS protocol version (for example, `TLS 1.2`, `TLS 1.3`). |
+| `tls_cipher_suite` | keyword | eBPF | _TLS only._ Negotiated TLS cipher suite (for example, `TLS_AES_256_GCM_SHA384`). |
diff --git a/calico-enterprise/observability/elastic/l7/enable-waypoint-collector.mdx b/calico-enterprise/observability/elastic/l7/enable-waypoint-collector.mdx
index ceb2e1f3e1..0035b556a3 100644
--- a/calico-enterprise/observability/elastic/l7/enable-waypoint-collector.mdx
+++ b/calico-enterprise/observability/elastic/l7/enable-waypoint-collector.mdx
@@ -1,20 +1,75 @@
---
description: Enable the Istio Ambient Mode Waypoint-based L7 collector.
-draft: true
---
# Collect L7 logs using the Waypoint collector
-Enable the Istio Ambient Mode Waypoint-based L7 collector to capture HTTP/1, HTTP/2, and gRPC traffic routed through a Waypoint proxy. For background on what the collector does and how it compares to other options, see [L7 logs overview](overview.mdx).
+Enable the Istio Ambient Mode Waypoint-based L7 collector to capture HTTP/1, HTTP/2, and gRPC traffic.
-:::note
+## Prerequisites
-This page is a placeholder. Content for L7 log collection via Istio Ambient Mode Waypoint proxies is pending.
+- A workload running in an [Istio Service Mesh](../../../compliance/istio/deploy-istio-ambient.mdx).
-:::
+## Enable the collector
-## Before you begin
+Once a workload is set up to be in the service mesh, L7 collection is enabled
+by adding a [waypoint proxy](https://istio.io/latest/docs/ambient/usage/waypoint/),
+and labeling the namespace to use it.
-## Enable the collector
+This will create an Istio Waypoint proxy that includes a sidecar container to
+capture the L7 logs.
+
+```bash
+cat << EOF | kubectl apply -n -f -
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+ name:
+ labels:
+ istio.io/waypoint-for: all
+spec:
+ gatewayClassName: istio-waypoint
+ listeners:
+ - name: mesh
+ port: 15008
+ protocol: HBONE
+EOF
+```
+
+```bash
+kubectl label namespace istio.io/use-waypoint=
+```
+
+Replace the following:
+
+- ``: The namespace your workload is in.
+- ``: What you want your waypoint proxy gateway to be called.
+
+## Remove the Waypoint collector
+
+```bash
+kubectl label namespace istio.io/use-waypoint-
+```
+
+## Disable the Waypoint collector
+
+If you are running waypoint proxies but you don't want sidecars added, the
+Waypoint collector sidecar can be disabled:
+
+```bash
+kubectl patch istio default --type=merge -p '{"spec":{"waypointLogging":"Disabled"}}'
+```
+
+Note that this applies to all waypoint proxies in the cluster.
## View L7 logs
+
+Waypoint collector logs are viewed in the [UI for L7 logs](configure.mdx#view-l7-logs-in-the-web-console)
+along with the other types of L7 logs.
+
+They will be labeled with the `collector_type`: `envoy-access-log` and the
+`collector_name`: `waypoint`.
+
+## Additional information
+
+- [L7 log data types](datatypes.mdx)
diff --git a/calico-enterprise/observability/elastic/l7/overview.mdx b/calico-enterprise/observability/elastic/l7/overview.mdx
index 7654605367..b54349b6d2 100644
--- a/calico-enterprise/observability/elastic/l7/overview.mdx
+++ b/calico-enterprise/observability/elastic/l7/overview.mdx
@@ -18,30 +18,28 @@ L7 logs complement L3/4 flow logs, which expose only the source/destination pair
## Collectors
-A *collector* is the component that observes traffic in your cluster and emits L7 log entries. $[prodname] supports multiple collectors. They all feed the same aggregation and reporting pipeline; each entry on the log file is tagged with `collector_type` so consumers can filter or join sources as needed.
+A _collector_ is the component that observes traffic in your cluster and emits L7 log entries. $[prodname] supports multiple collectors. They all feed the same aggregation and reporting pipeline; each entry on the log file is tagged with `collector_type` so consumers can filter or join sources as needed.
- **eBPF collector** — kernel TCP-layer probes that capture HTTP and TLS metadata with no data path proxy or sidecar. Enable once at the cluster level. Works with any data plane — you do not need the eBPF data plane to use it. See [Enable eBPF collector](enable-ebpf-collector.mdx).
-{/* TODO: re-add Istio Waypoint collector bullet when the Waypoint PR lands. */}
+- **Waypoint collector** — Waypoint proxy based Envoy sidecar. See [Enable Waypoint collector](enable-waypoint-collector.mdx).
- **Envoy collector** _(legacy, deprecated)_ — sidecar Envoy injected per workload. Being phased out. See [Enable Envoy collector](configure.mdx).
### Why more than one collector?
Each collector lives at a different point in the request path and exposes different trade-offs. Pick by where you need coverage and what infrastructure you're willing to run:
-{/* TODO: re-add the Istio Waypoint column when the Waypoint PR lands. */}
-
-| | eBPF | Envoy (legacy) |
-| --- | --- | --- |
-| Additional infrastructure | None — runs inside Felix | Sidecar Envoy per workload |
-| Protocol coverage | HTTP/1.x, TLS handshake | HTTP |
-| Opt-in granularity | Cluster-wide (FelixConfiguration) | Per workload (label + annotation) |
-| Service-mesh compatibility | Any data plane | Not compatible with Istio |
+| | eBPF | Envoy (legacy) | Waypoint |
+| -------------------------- | --------------------------------- | --------------------------------- | -------------------------------- |
+| Additional infrastructure | None — runs inside Felix | Sidecar Envoy per workload | Sidecar Envoy per Waypoint proxy |
+| Protocol coverage | HTTP/1.x, TLS handshake | HTTP | HTTP/1, HTTP/2, gRPC |
+| Opt-in granularity | Cluster-wide (FelixConfiguration) | Per workload (label + annotation) | Per namespace (label) |
+| Service-mesh compatibility | Any data plane | Not compatible with Istio | Istio Ambient Mode only |
Multiple collectors can coexist in the same cluster, with each L7 log entry tagged by `collector_type` so consumers can filter or join sources as needed.
## Next steps
- [Enable eBPF collector](enable-ebpf-collector.mdx)
-{/* TODO: re-add [Enable Waypoint collector](enable-waypoint-collector.mdx) when the Waypoint PR lands. */}
+- [Enable Waypoint collector](enable-waypoint-collector.mdx)
- [L7 log data types](datatypes.mdx)
- [Log aggregation](../aggregation.mdx)